- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201507-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Oracle JRE/JDK: Multiple vulnerabilities Date: July 10, 2015 Bugs: #537214 ID: 201507-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Oracle JRE/JDK, allowing both local and remote attackers to compromise various Java components. Background ========== Oracle=E2=80=99s Java SE Development Kit and Runtime Environment Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-java/oracle-jre-bin < 1.8.0.31 >= 1.8.0.31 < 1.7.0.76 >= 1.7.0.76 2 dev-java/oracle-jdk-bin < 1.8.0.31 >= 1.8.0.31 < 1.7.0.76 >= 1.7.0.76 ------------------------------------------------------------------- 2 affected packages Description =========== Multiple vulnerabilities have been discovered in Oracle JRE/JDK. Please review the CVE identifiers referenced below for details. Impact ====== An context-dependent attacker may be able to influence the confidentiality, integrity, and availability of Java applications/runtime. Workaround ========== There is no workaround at this time. Resolution ========== All Oracle JRE 8 users should upgrade to the latest stable version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-java/oracle-jre-bin-1.8.0.31 All Oracle JDK 8 users should upgrade to the latest stable version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-java/oracle-jdk-bin-1.8.0.31 All Oracle JRE 7 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-java/oracle-jre-bin-1.7.0.76 All Oracle JDK 7 users should upgrade to the latest stable version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-java/oracle-jdk-bin-1.7.0.76 References ========== [ 1 ] CVE-2014-3566 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3566 [ 2 ] CVE-2014-6549 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6549 [ 3 ] CVE-2014-6585 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6585 [ 4 ] CVE-2014-6587 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6587 [ 5 ] CVE-2014-6591 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6591 [ 6 ] CVE-2014-6593 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6593 [ 7 ] CVE-2014-6601 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6601 [ 8 ] CVE-2015-0383 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0383 [ 9 ] CVE-2015-0395 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0395 [ 10 ] CVE-2015-0400 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0400 [ 11 ] CVE-2015-0403 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0403 [ 12 ] CVE-2015-0406 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0406 [ 13 ] CVE-2015-0407 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0407 [ 14 ] CVE-2015-0408 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0408 [ 15 ] CVE-2015-0410 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0410 [ 16 ] CVE-2015-0412 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0412 [ 17 ] CVE-2015-0413 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0413 [ 18 ] CVE-2015-0421 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0421 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201507-14 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5